mirror of
https://github.com/tailscale/tailscale.git
synced 2024-12-04 23:45:34 +00:00
655b4f8fc5
I updated the address parsing stuff to return a specific error for unspecified hosts passed as empty strings, and look for that when logging errors. I explicitly did not make parseAddress return a netip.Addr containing an unspecified address because at this layer, in the absence of any host, we don't necessarily know the address family we're dealing with. For the purposes of this code I think this is fine, at least until we implement #12588. Fixes #12979 Signed-off-by: Aaron Klotz <aaron@tailscale.com>
225 lines
6.1 KiB
Go
225 lines
6.1 KiB
Go
// Copyright (c) Tailscale Inc & AUTHORS
|
|
// SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
package netns
|
|
|
|
import (
|
|
"fmt"
|
|
"math/bits"
|
|
"net/netip"
|
|
"strings"
|
|
"syscall"
|
|
|
|
"golang.org/x/sys/cpu"
|
|
"golang.org/x/sys/windows"
|
|
"golang.zx2c4.com/wireguard/windows/tunnel/winipcfg"
|
|
"tailscale.com/envknob"
|
|
"tailscale.com/net/netmon"
|
|
"tailscale.com/tsconst"
|
|
"tailscale.com/types/logger"
|
|
)
|
|
|
|
func interfaceIndex(iface *winipcfg.IPAdapterAddresses) uint32 {
|
|
if iface == nil {
|
|
// The zero ifidx means "unspecified". If we end up passing zero
|
|
// to bindSocket*(), it unsets the binding and lets the socket
|
|
// behave as normal again, which is what we want if there's no
|
|
// default route we can use.
|
|
return 0
|
|
}
|
|
return iface.IfIndex
|
|
}
|
|
|
|
func defaultInterfaceIndex(family winipcfg.AddressFamily) (uint32, error) {
|
|
iface, err := netmon.GetWindowsDefault(family)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
|
|
return interfaceIndex(iface), nil
|
|
}
|
|
|
|
func control(logf logger.Logf, _ *netmon.Monitor) func(network, address string, c syscall.RawConn) error {
|
|
return func(network, address string, c syscall.RawConn) error {
|
|
return controlC(logf, network, address, c)
|
|
}
|
|
}
|
|
|
|
var bindToInterfaceByRouteEnv = envknob.RegisterBool("TS_BIND_TO_INTERFACE_BY_ROUTE")
|
|
|
|
// controlC binds c to the Windows interface that holds a default
|
|
// route, and is not the Tailscale WinTun interface.
|
|
func controlC(logf logger.Logf, network, address string, c syscall.RawConn) (err error) {
|
|
if isLocalhost(address) {
|
|
// Don't bind to an interface for localhost connections,
|
|
// otherwise we get:
|
|
// connectex: The requested address is not valid in its context
|
|
// (The derphttp tests were failing)
|
|
return nil
|
|
}
|
|
|
|
canV4, canV6 := false, false
|
|
switch network {
|
|
case "tcp", "udp":
|
|
canV4, canV6 = true, true
|
|
case "tcp4", "udp4":
|
|
canV4 = true
|
|
case "tcp6", "udp6":
|
|
canV6 = true
|
|
}
|
|
|
|
var defIfaceIdxV4, defIfaceIdxV6 uint32
|
|
if canV4 {
|
|
defIfaceIdxV4, err = defaultInterfaceIndex(windows.AF_INET)
|
|
if err != nil {
|
|
return fmt.Errorf("defaultInterfaceIndex(AF_INET): %w", err)
|
|
}
|
|
}
|
|
|
|
if canV6 {
|
|
defIfaceIdxV6, err = defaultInterfaceIndex(windows.AF_INET6)
|
|
if err != nil {
|
|
return fmt.Errorf("defaultInterfaceIndex(AF_INET6): %w", err)
|
|
}
|
|
}
|
|
|
|
var ifaceIdxV4, ifaceIdxV6 uint32
|
|
if useRoute := bindToInterfaceByRoute.Load() || bindToInterfaceByRouteEnv(); useRoute {
|
|
addr, err := parseAddress(address)
|
|
if err == nil {
|
|
if canV4 && (addr.Is4() || addr.Is4In6()) {
|
|
addrV4 := addr.Unmap()
|
|
ifaceIdxV4, err = getInterfaceIndex(logf, addrV4, defIfaceIdxV4)
|
|
if err != nil {
|
|
return fmt.Errorf("getInterfaceIndex(%v): %w", addrV4, err)
|
|
}
|
|
}
|
|
|
|
if canV6 && addr.Is6() {
|
|
ifaceIdxV6, err = getInterfaceIndex(logf, addr, defIfaceIdxV6)
|
|
if err != nil {
|
|
return fmt.Errorf("getInterfaceIndex(%v): %w", addr, err)
|
|
}
|
|
}
|
|
} else {
|
|
if err != errUnspecifiedHost {
|
|
logf("[unexpected] netns: error parsing address %q: %v", address, err)
|
|
}
|
|
ifaceIdxV4, ifaceIdxV6 = defIfaceIdxV4, defIfaceIdxV6
|
|
}
|
|
} else {
|
|
ifaceIdxV4, ifaceIdxV6 = defIfaceIdxV4, defIfaceIdxV6
|
|
}
|
|
|
|
if canV4 {
|
|
if err := bindSocket4(c, ifaceIdxV4); err != nil {
|
|
return fmt.Errorf("bindSocket4(%d): %w", ifaceIdxV4, err)
|
|
}
|
|
}
|
|
|
|
if canV6 {
|
|
if err := bindSocket6(c, ifaceIdxV6); err != nil {
|
|
return fmt.Errorf("bindSocket6(%d): %w", ifaceIdxV6, err)
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func getInterfaceIndex(logf logger.Logf, addr netip.Addr, defaultIdx uint32) (idx uint32, err error) {
|
|
idx, err = interfaceIndexFor(addr)
|
|
if err != nil {
|
|
return defaultIdx, fmt.Errorf("interfaceIndexFor: %w", err)
|
|
}
|
|
|
|
isTS, err := isTailscaleInterface(idx)
|
|
if err != nil {
|
|
return defaultIdx, fmt.Errorf("isTailscaleInterface: %w", err)
|
|
}
|
|
if isTS {
|
|
return defaultIdx, nil
|
|
}
|
|
return idx, nil
|
|
}
|
|
|
|
func isTailscaleInterface(ifaceIdx uint32) (bool, error) {
|
|
ifaceLUID, err := winipcfg.LUIDFromIndex(ifaceIdx)
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
|
|
iface, err := ifaceLUID.Interface()
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
|
|
result := iface.Type == winipcfg.IfTypePropVirtual &&
|
|
strings.Contains(iface.Description(), tsconst.WintunInterfaceDesc)
|
|
return result, nil
|
|
}
|
|
|
|
func interfaceIndexFor(addr netip.Addr) (uint32, error) {
|
|
var sockaddr winipcfg.RawSockaddrInet
|
|
if err := sockaddr.SetAddr(addr); err != nil {
|
|
return 0, err
|
|
}
|
|
|
|
var idx uint32
|
|
if err := getBestInterfaceEx(&sockaddr, &idx); err != nil {
|
|
return 0, err
|
|
}
|
|
|
|
return idx, nil
|
|
}
|
|
|
|
// sockoptBoundInterface is the value of IP_UNICAST_IF and IPV6_UNICAST_IF.
|
|
//
|
|
// See https://docs.microsoft.com/en-us/windows/win32/winsock/ipproto-ip-socket-options
|
|
// and https://docs.microsoft.com/en-us/windows/win32/winsock/ipproto-ipv6-socket-options
|
|
const sockoptBoundInterface = 31
|
|
|
|
// bindSocket4 binds the given RawConn to the network interface with
|
|
// index ifidx, for IPv4 traffic only.
|
|
func bindSocket4(c syscall.RawConn, ifidx uint32) error {
|
|
// For IPv4 (but NOT IPv6) the interface index must be passed
|
|
// as a big-endian integer (regardless of platform endianness)
|
|
// because the underlying sockopt takes either an IPv4 address
|
|
// or an index shoved into IPv4 address representation (an IP
|
|
// in 0.0.0.0/8 means it's actually an index).
|
|
//
|
|
// See https://docs.microsoft.com/en-us/windows/win32/winsock/ipproto-ip-socket-options
|
|
// and IP_UNICAST_IF.
|
|
indexAsAddr := nativeToBigEndian(ifidx)
|
|
var controlErr error
|
|
err := c.Control(func(fd uintptr) {
|
|
controlErr = windows.SetsockoptInt(windows.Handle(fd), windows.IPPROTO_IP, sockoptBoundInterface, int(indexAsAddr))
|
|
})
|
|
if err != nil {
|
|
return err
|
|
}
|
|
return controlErr
|
|
}
|
|
|
|
// bindSocket6 binds the given RawConn to the network interface with
|
|
// index ifidx, for IPv6 traffic only.
|
|
func bindSocket6(c syscall.RawConn, ifidx uint32) error {
|
|
var controlErr error
|
|
err := c.Control(func(fd uintptr) {
|
|
controlErr = windows.SetsockoptInt(windows.Handle(fd), windows.IPPROTO_IPV6, sockoptBoundInterface, int(ifidx))
|
|
})
|
|
if err != nil {
|
|
return err
|
|
}
|
|
return controlErr
|
|
}
|
|
|
|
// nativeToBigEndian returns i converted into big-endian
|
|
// representation, suitable for passing to Windows APIs that require a
|
|
// mangled uint32.
|
|
func nativeToBigEndian(i uint32) uint32 {
|
|
if cpu.IsBigEndian {
|
|
return i
|
|
}
|
|
return bits.ReverseBytes32(i)
|
|
}
|